From their inception, computer networks have grown in use and capability to the point where they millions of people either use or are affected by networks on a daily basis. Networks operate to communicate data from one point to another according to a particular network protocol. The Internet protocol is perhaps the most widely used network protocol in today.
In order to assist in assuring that data flows smoothly from one point to another, the ICMP (Internet Control Message Protocol) was developed to gather information, report error conditions, and set network routing parameters. When used properly, ICMP messages are a powerful mechanism to ensure that network data is communicated in a timely and efficient manner.
Unfortunately, the same messages that may be used to enhance network performance may be used by a malicious party to cause harmful affects to the network or a host on a network. Various forms of attacks using ICMP messages have been developed by malicious users. Many of the attacks involve the attacker generating spurious ICMP packets that can cause effects like terminating network connections. Further, the attacks may involve spoofing. In spoofing, the ICMP message data is altered in a way so that the packet appears to come from a source different than the true source of the message.
Other attacks can cause a system to reroute packets to an unintended location, either to attempt to overwhelm the unintended location with network traffic or to allow a malicious user to examine the data to attempt to glean information from the network data. An ICMP redirect related attack is such an attach and is based on an attacker generating a spoofed ICMP redirect packet to the host, requesting the use of a default gateway which could either lead to the packet being blackholed (lost forever) or redirecting all those packets to the attacker so that the attacker can examine these packets.
A source quench related attack is based on an attacker sending out source quench ICMP messages back to the source even in cases where there is no network congestion. For hosts that act on this type of message, this can compromise the quality of a TCP connection for cases where there is no real network congestion. One of the current methods of mitigating these attacks would be for end hosts to not respond to ICMP source quench messages.
There are several ICMP attacks related to the destination unreachable message. An attacker can create a spoofed packet with the port or protocol unreachable set and send this message to the sender. On receiving this message, the originating host typically terminates the TCP connection by treating this message as a hard error. This may cause a valid TCP connection to be unexpectedly (and invalidly) terminated.
Other types of attacks may use ICMP messages to cause a denial of service to a host. In this type of attack, a malicious user generates ICMP echo packets that result in the target host being flooded with great amounts of ICMP messages which will leave the attacked host and its associated network with degraded performance or even total denial of service in some instances.
Current mechanisms to prevent these types of attacks typically involve turning off ICMP messages related to the attack method. While this prevents the attack, it also prevents the system from gaining the benefits that the ICMP message was intended to provide.